Meta said on 20 October it had paused sharing links for its Muse AI assistant after researchers found users’ conversations through public DNS records, Ars Technica reported. The link design put business and personal material within reach of people who had never received a share link.
Key points
- Claroc researchers found thousands of Muse share links with one passive DNS query.
- Conversation titles appeared in link subdomains, making the addresses searchable through DNS records.
- Meta says it has paused sharing while it reviews the findings and considers changes.
Claroc’s one-query search of Muse links
Researchers at security firm Claroc said a single passive DNS query yielded 6,800 Muse share links, Ars Technica reported. The Verge reported more than 6,800 links. Claroc calls the vulnerability GhostShares.
Muse lets users create links to conversations, searches and images for other people to open. Those addresses included long strings intended to make them hard to guess, but Meta also put conversation titles in subdomains of cf.metaaiusercontent.com. That placement made the addresses discoverable through passive DNS services, which collect records of domain names resolved to IP addresses.
A DNS record could be collected once a recipient opened a shared page. Claroc said a recorded hostname carried both the title and the identifier needed to reconstruct the link. The researchers could search for shares rather than guess their long strings one by one.
Muse links exposed loan and revenue records
Claroc’s researchers opened a few hundred of the links. The pages included an in-house revenue assessment labelled for the chief executive of a nationwide marketing firm, a loan request from a small-business proprietor and an employer’s annual staff holiday rota. Another page held a candidate’s preparation notes for a confidential executive-search call with a frontier AI lab, including an internal contact and the meeting time.
The exposure matters for an assistant built to handle consequential tasks. Muse can fill out forms, book appointments and make purchases, and requires access to most of a user’s accounts to work as intended. AI Affairs reported that Muse passed 10 million US downloads in its first 40 days.
Meta pauses sharing after Claroc’s 8 October report
Meta CEO Mark Zuckerberg described Muse in September as “built from the ground up for privacy and security,” Ars Technica reported. Three weeks after its launch, macOS security expert Patrick Wardle found a separate flaw that could let another app on the same device take control of a user’s Muse account.
Claroc co-founder and CTO Asaf Aprozper said he submitted the share-link findings through Meta’s bug bounty programme on 8 October. Muse spokesperson Tracy Clayton told The Verge that a user-created share produced a page accessible to anyone holding its link. She said Meta had paused the feature while it reviewed the report and considered changing how the links could be discovered.
